Missing initializer protection allows attackers to overtake the leveraged position contract of any user

Description

• Normal behavior - User deploys new Stratax contract, initialize it, starts creating leveraged positions etc..

• Issue - Constructor is empty and owner as well as other critical params are set in the initialize function which has no protection and can be called by a malicious user

Risk

Likelihood:

• High: Everyone can frontrun the actual owner's tx to initialize the Stratax contract

Impact:

• Impact - Users cannot create leveraged positions since they won't be the owners

• Impact - Malicious oracle registered

• Impact - Random address set for aave pool

• Impact - Random address set for 1inch router

• Impact - Random address for aave data provider

Proof of Concept

1. Bob wants to create a leverage position and firstly deploys a new Stratax contract for that purpose

2. Since this happens through a proxy , the Stratax.sol is an implementation contract and has initialize

3. The contract initialization has no protection and constructor is missing _disableInitializers()

4. Attacker frontruns user's initalization and overtakes the contract

Recommended Mitigation

1. Update the constructor to have _disableInitializers()

2. Implement access control